Main Vulnerability Database Vulnerabilities #VU155561

Use-after-free in Office Online Server and Microsoft Office - CVE-2026-97738

Published: October 14, 2026

Vulnerability identifier: #VU155561

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-97738

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use-after-free in Microsoft Office Excel when processing malicious Office files. A remote attacker can send a malicious Office file and convince the victim to open it to execute arbitrary code.

The Preview Pane is not an attack vector.

Affected software

Office Online Server
Microsoft Office

How to mitigate CVE-2026-97738

Install security update from vendor's website.

Office Online Server - update to 16.0.10417.20228
Microsoft Office - addressed in versions 16.0.14334.20974, 16.0.17932.21056

External References

Related Security Bulletins